GMSR 

Fteport 

November 1989 



iMASA 

OFFICE OF MANAGEMENT 


iNFORMATiON RESOURCtS 
MANAGEMENT 


NASA PERSONNEL/PAYROLL SYSTEM iNppS’I BliUGET 


SITUATION 


STATUS 

• DEVELOPMENT PROBLEMS HAVE CAUSED- 

- COST OVERRUN OF $1.2M 

- SCHEDULE STRETCHOUi uf- y MfJN f HS 

• DEVELOPMENT OVERRUN 

- WILL BE FUNDED FROM NPPS MAINTENANCE FUNDS NO 
LONGER REQUIRED DUE TO SCHEDULE SLIP 

- HAS NOT IMPACTED OTHER AIM PROJECT FUNDING IN FY 1990 

CONCERNS 

• FUNDING LEVEL UNKNOWN FOR FY 1990 

• CAPPS PROJECT REMAINS SUSPENDED 

• FUNDING DELAYS/INTERVENTIONS CONTINUE TO RAP INORDINATE 
AMOUNTS OF ENERGY 

PLANS 

• CONTINUE IMPLEMENTATION OF JSC CORRECTIVE ACTION PLAN 

• EVALUATE AIM PROGRAM ASSESSMENT BOARD RECOMMENDATIONS 
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NRP AT KSC 

BACKGROUND 

• ORIGINAL COST ESTIMATES FOR FY89 WERE UNDERESTIMATED: 

- SOME OF ORIGINAL COFF COSTS WERE CARRIED AS R&PM 

- UNABLE TO USE EXISTING EMERGENCY POWER SUBSTATION AS ORIGINALLY 
PLANNED 

- PRELIMINARY ENGINEERING REPORT (JUNE 9, 1989) REFLECTS INCREASED 
CCTV LIGHTING LEVEL REQUIREMENT 

-- INSTALLATION OF FENCING, GUARD HOUSES AND PERIMETER LIGHTING FOR 
PAD -A" NOT IN BUDGET WRITE-UPS 

CURRENT STATUS 

• FY89 & FY90 COFF FUNDING {$4.2M) APPEARS SUFFICIENT FOR PADS "A" & "B" 

- HQ/KSC MEETING (SEPTEMBER 28, 1989) DESIGNATED PADS AS PRIORITY 

• DESIGN PHASE OF IMPLEMENTATION PLAN FOR PADS STARTED OCTOBER 1989 

• REMAINING PROJECTS IN JEOPARDY 

CONCERNS 

• REMAINING PROJECTS MUST BE DEFERRED 

■ FUNDED PAD PROJECTS IN JEOPARDY FROM FY90 COFF BUDGET REDUCTIONS 

PLANS 

• KSC HAS SUBMITTED A FY92 COFF PROJECT FOR BALANCE OF THE WORK 
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FY66 

FY 87 

FYea 

FY 89 

FY 90 

FY 91 

CONVERSION 

TOTALS 

ORIGINAL PLAN 
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$100 
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1 $1.253 DIVERTED IN FY 68 

2 ESTIMATED 

3 SHORTFALL PROVIDED FROM CODE NT RUOGET 


A ACTUALS THROUGH FY 89 
5 ASSUME S679 DIVERTED IN FY 90 IS RECOVERED 
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SPACE PHYSICS ANALYSIS NETWORK fSPAN> 
WORM INCIDENT 


BACKGROUND ON .SPAN 

• CREATED IN 1981 FOR OPEN EXCHANGE OF SCIENTIFIC 
INFORMATION BY RESEARCHERS 

• COMPOSED OF INTERNATIONAL NETWORK OF APPROXIMATELY 
6,000 NODES SERVING APPROXIMATELY 100,000 USERS: 

- GOVERNMENT (APPROXIMATELY 600 NASA MANAGED) 

- PRIVATE INDUSTRY 

- UNIVERSITY 

• CAN BE ACCESSED FROM ALMOST ANYWHERE IN WORLD 
USING A PERSONAL COMPIITFH AND TFI FPHOME 
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nFSCRIPTIQN OF ATTACK 

• ORIGIN TRACED TO FRANCE 

• WORM CODE: 

- EXPLOITS POOR PASSWORD MANAGEMENT PRACTICES 

- NASA VICTIMS FAILED TO FOLLOW PUBLISHED AGENCY POLICIES 
AND PROCEDURES 

- CAUSES 

- DISRUPTION AND DENIAL OF SERVICE 

- EXPENDITURE OF RESOURCES TO TECHNICALLY DIAGNOSE 
AND DISINFECT AFFECTED SYSTEMS 

- DISPLAY OF BANNER ON USER SCREENS 

• TWO PHASED ATTACK 

- OCT 16 ATTACK AFFECTED APPROXIMATELY 90 NODES 

- OCT 29 ATTACK AFFECTED OVER 500 NODES 

- USED IMPROVED VERSION TO EXPLOIT ADDITIONAL PASSWORDS 

• SPECIFIC IDENTIFICATION OF PENETRATED NODES UNDERWAY 

- ONLY 3 IDENTIFIED AT NASA TO DATE 

• ATTACK IS STILL ACTIVE 


— 


N 

(MASA 

OFFICE OF MANAGEMENT 

INFORMATION 
RESOURCES MANAGEMENT 



SPACE PHYSIOS ANALYSIS NETWORK (SPAN) 
WORM INCIDENT 







niACA INFORMATION 

OFFICE OF MANAGEMENT RESOURCES MANAGEMENT 


SPACE PHYSICS ANALYSIS NETWORK (SPAN) 
WORM INCIDENT 


EFFORTS TO REDUCE FUTURE RISK EXPOSURE 

• INSTRUCTIONS BEING REISSUED TO ALL NODE MANAGERS TO 
STRENGTHEN PASSWORD MANAGEMENT PRACTICES 

• SELECTED NETWORK NODES (NASA AND NON-NASA) WILL BE 
AUDITED TO ASSURE COMPLIANCE WITH PASSWORD MANAGEMENT 
INSTRUCTIONS 

• NASA/IG AND FBI ARE INVESTIGATING FOR PROSECUTION 

HOWEVER 

• OPEN INTERNATIONAL NETWORKS WILL ALWAYS HAVE A CERTAIN 
LEVEL OF VULNERABILITY 
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FY 1990-1992 ACTION PLAN/ 

COMMITMENTH'ARGET TARGET/DATE 


• ESTABLISH OFFICE OF MANAGEMENT EQUALITY CIRCLE FIRST MEETING SCHEDULED 

DECEMBERS. 1989 

• SEPERATE EQUAL OPPORTUNITY AND MULTI-CULTURAL 
EDUCATION PROGRAM TRAINING FOR ALL 
EMPLOYEES 

• AVERAGE 1 PROFESSIONAL DEVELOPMENT TRAINING 
INCIDENT PER EMPLOYEE PER YEAR 

• DEVELOP CAREER COMPETENCY DEVELOPMENT 
PROGRAM PILOT PROJECT 

- MEET OR EXCEED 20yo MINORITY MALE AND FEMALE 
PRC^ESSIONAL WORKFORCE (FTE. CO-OP. AND PMI) 

REPRESENTATION GOAL ESTABLISHED AS A RESULT 
OF THE MEAN AGREEMENT 

• INCREASE NUMBER OF MINORITY FEMALE EMPLOYEES 
AT OR ABOVE GS-14 FROM 0 TO 3 


V_ / 


HAVE REQUESTED PROGRAM 
— DEVELOPMENT DISCUSSIONS WITH 
CODE DP TO START BY EARLY 
DECEMBER 1989 


— DEVELOP PROACTIVE CODE N 
STRATEGY FOR MINORITY 
RECRUITMENT BY JANUA Y 31.1990 
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